GPEN Password Attacks and Formats Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To decrypt the hash using the specified algorithm.

  Why it's wrong here

  Hashes are one-way functions and cannot be decrypted. The term 'decrypt' is technically incorrect in the context of password hashes. Rules are used to generate candidates for comparison against a target hash, not to perform any form of mathematical reversal on the hash value itself during the process.

• ✓

  To transform dictionary words into common password variations.

  Why this is correct

  Rules allow for the programmatic mutation of wordlist entries. By applying rules such as appending numbers, capitalizing, or substituting characters, testers can simulate common user password patterns. This dramatically improves success rates against users who follow simple patterns to satisfy organizational password complexity policies during the cracking process.

• ✗

  To automatically update the hashing algorithm to a newer standard.

  Why it's wrong here

  Rules do not influence the hashing algorithm itself. The algorithm is predefined by the hash type (e.g., -m 1800). Rules are strictly for manipulating the candidate plaintext input before it is passed through the hashing function for comparison against the target hash value extracted from the target system.

• ✗

  To bypass account lockout mechanisms on the target system.

  Why it's wrong here

  Rules operate locally on the attacker's machine and have no impact on the target system's network defenses. They are purely for optimizing the search space of the dictionary attack, not for interacting with the authentication service in a way that would circumvent or bypass account lockout policies.